How to remove an indexer from the distributed management console?

[a212830]

Hi,

I removed some indexers from Splunk, using the offline command, but they are all still showing up in my distributed management console, and listed as "unreachable". How do I remove them from the DMC?

[lgely]

Hi,

modify the assets.csv file on the instance where is installed DMC

file locate = etc/apps/splunk_management_console/lookups/assets.csv

You need to update this file with the new/good informations (in my case new SH, change name/IP and ID if different)

I just :
modify my "distsearch.conf" on DMC instance
modify the "assets.csv" on DMC instance
add the trusted.pem on my new SH
restart my new SH and my DMC instance
and all is OK

Hope help you

[sherm77]

This was the only thing that worked for me, at least editing the assets.csv. A decomm'd indexer wouldn't go away from the monitoring console, editing the assets.csv took the indexer out of the monitoring console (v6.6.3).

[xtrjx]

I also had the same problem but the indexer I took down did not show at all in the DMC settings so I could not disable it. I just clicked the "Apply Changes" button anyway and that removed the indexer from the other DMC views.

[DEAD_BEEF]

Go to Settings > Monitoring Console > Settings > General Setup > "Apply Changes"

For some reason this fixed my issue as well despite making no other changes.

[isoutamo]

This will update those lookups which are used for MC’s different views. It is always needed after you have done those changes on your infrastructure.

[Gregski11]

this worked for us, after days of struggle, thank you so much

[greich]

whether you edit in UI or the conf files, it does not always update the kvstore until you "Apply changes"

[amiller100]

I had to do the same as above. Within the Monitoring Console I performed the "Apply Changes" and that removed the decommissioned indexer from view.

[CaptainHook]

After you click on "Apply Changes" that did work for me also.

[fabiocaldas]

I had the same problem but runnign all steps again it worked

1 - Open the DMC -> Settings -> General Setup -> Edit next to the indexer -> Disable monitoring
2 - Restart Master server
3 - Apply Changes on DMC -> Settings -> General Setup

[fabiocaldas]

I did what @somesoni2 and @jkat54 recommended but node is still "Unreachable"

[mosman_splunk]

you need to disable it as search peer Settings / Distributed search / Search peers

then you need to remove it from dmc settings" -> general setup -> edit next to the indexer -> disable monitoring

[a212830]

See above - did all that...

[fabiocaldas]

I also did but it doesn't solved the problem

[jkat54]

See if this works:

Open the DMC, click on menu called "settings" -> general setup -> edit next to the indexer -> disable monitoring

[a212830]

It gets more interesting...

The "Overview" page shows 18 indexers and 12 unreachable (the 12 that I decommed via "offline"). The general setup page does not show them at all. I went into the "managementconsole_overview" view, and it lists the following:

<?xml version="1.0"?>
<view template="pages/app.html" type="html">
    <label>Overview</label>
</view>

I looked for that html page under ../etc, but found nothing. Thoughts?

[somesoni2]

You can just remove them from Settings / Distributed search / Search peers

[a212830]

Did that, restarted DMC - didn't make a difference.